I love how he talked at the start about Syria blocking TLS, a Syrian previous media activist, used TOR all through 2011 and 2012, got arrested by the Syrian regime intelligence and all what they accused me of is "having suspicious internet activities" but then I got released, I do remember emailing the TOR project for a specific question (I wanted a port forwarding recommendation for live streams using my android phone to stream a protest) and they were very very helpful and literally kept talking to me not just about this question, but also giving my tips specifically for my case use of TOR, can't that you enough guys! and please consider to run a node if u can it helps ppl (and don't use bridges if u don't need to please!)
41:22 - "I think Russia has already blocked Facebook, but next it's gonna be, like, Linkedin" - nope, it's blocked already, in fact. Had been even earlier than Facebook, if I recall correctly
Hmm, would it be possible to replace the Bitcoin proof of work with some kind of proof of transport so that mining becomes the provision of Tor relays?
You might want to have a look at the Helium network - but on the Internet instead of wireless. One problem, though: just because some node transported your proof of transport doesn't mean it will also transport your actual traffic.
@@thewhitefalcon8539 Right, but if you encrypt the traffic and the proof so that the node doing the transport can't tell the difference. Designing it right to have all the right incentives would be hard but u could probably get at least a probabilistic guarantee they'd transport traffic.
Google “Lox: Protecting the Social Graph in Bridge Distribution” (there’s a whitepaper on petsymposium) For salmon you can start with wikipedia article for “Salmon (protocol)”
One of the reason of huge spike in Tor connections from Ukraine during first weeks of the russian invasion, that many hacktivists uses Tor for DDoS of the russian propaganda sites, financial and logistic infrastructure. But usage of Tor turned out to be ineffective, so different measures were taken later.
30:25 uncertainty is certain We might be about to get occupied, max uncertainty in the people with something to lose ? some subset of people in the moment need to do something. Move some Bitcoin out of the country ? send a message about relocation ? not willing to hang around. Clear to everyone shit is not going to be good. Whatever it was, significant change of some sort was the only priority for this subset of people and their circumstances. Relatively small group, other countries would have drastically different stats.. some would see sustained and perhaps S curve adoption, civil war possibilities etc etc Fascinating, amazing presentation
mTLS should be considered for the bridges, then maybe you can give out keys instead of just addresses, if a good key isn't provided, just ignore it and give a different webpage.
Spikes in tor users in Ukraine on the intitial days may be : - Russians living in Ukraine wanting to get out of Ukraine - Ukraine civilains wanting to get out of Ukraine - Ukraine civilians wanting to defect from Ukraine Either or all, non of them wanting their intention exposed
Here in Merica, people are proud of the 2nd. The right to bear arms. The fight of a few rednecks in pickups vs US military, anyone can see that outcome. What is MOST important is the ability to communicate freely and evade censorship is VITAL. Especially in totalitarian nations where the people have no way to fight back other than numbers. If the Chinese people could ever get on the same page, they could topple the government just from mass numbers. A government can't kill or imprison 75% of the population.
"few rednecks in pickups vs US military, anyone can see that outcome". Yeah I think usa and Russia thought the same about Afghanistan...went great for the two largest superpowers vs a bunch of "goat herders".
@@bryant2627they had mountains to hide in. It’s a totally different gorilla war fare in them mountains. The afghans also were born into defense due to the Russians trying to invade and the cia gave them old Cold War stockpile anti air missle sand old aks delta force or green beret probably taught them basic combat concepts and outcomes. That or cia. The afghans are the best at walking threw them mountains. Special forces said they are like goats there so strong from walking mountains all there life they say in the hub where they work up mission plan that if a afghan gets his legs around you your dead you won’t be able to get him off.
Russian hackers are the ones that are using the most sofisticated and more reliable access to TOR. Even the ones working for the government. All the accesses should be easy, since the average people (the one that give or need information) is surely not able to go further than downloading and launching the TOR browser (and already this is not so average). If not those "bad" ones are the only people that will benefit...
Russia has plenty of out of country proxy’s to access tor from. The damage caused be helping the Russian people see all the facts of the war is worth the effort
No. Tor not used only by "bad ones". FSB and other f*ckfaces are most likely have their own VPS in Europe, legally bought by the way; yes, you still can buy VPS with Russia's bank account, and maybe Im already gone insane, but I think "normal" russians can get problems with police if they look into your account and find that you bying proxy for yourselves, and god forbid you use it to do something that "descriminates army of Russia". Tor is just too slow in general and often connections are just dying, but it's nice to have, especially when you don't want to install random "VPN" crap on your computer and have accounts for it.
30:24 mind that Ukraine also has been doing censorship of major websites from 2016 or so in an unstable situation reaching for sources of information from both sides might have been important for many
@@johngiaus8632 The Ukrainian government could lie or censor news to paint themselves in a more positive light or preserve military secrecy, while Russian media reported on which city your friends live in just got hit with a missile strike. You need to be able to piece together the truth for yourself from multiple sources
several reasons ukrainians or other people in ukraine could want safe comms with people in russia. the biggest group are family connections, second group is businesses and organizations operating in both countries. pro-russia operators in ua are probably not numerous enough to contribute much to such stats.
@@ivanslaboratory The IP addresses of all Tor relays and the real-life owners of most are public info. That's how you know you're not getting an evil relay
@@thewhitefalcon8539The identity being published does not mean is legitimate, could be name borrowers. Same as your public IP address could be someone's elses. :) To my knowledge exit nodes are public info, so that can be blocked in case :)
i would say that rt and similar outlets are at least equal to social engineering. If all people would be informed about the background, mo and goals of these disinformation campaigns, they would treat them as such. But this level of knowledge is just not there, they are currently incredibly harmful and no democracy has tools or strategies at place to fight them. Banning is a brute force approach yes, but it is necessary to act on this someway.
AEweb thoughts ? building on this web3 platform with Uniris biometrics and hierarchical transaction chains structure seems.. unbounded ? "the first ever tamperproof identification that doesn't store any data" is the main selling point but integrating the various technologies of today in the way they have is potentially the end game for defenders ? Imagine all content on the internet has a meta tag of human or not..
Tor still has centralization it uses centralized dns servers for all dns you can proxy dns over tor but it still requires trust of centralized dns servers onion services also use centralized matching servers they do allow you to encrypt the metadata on the central server but it is encryption that the NSA can break with there quantum computer and it requires setting up a key pair for each user also Russia isn't the only one censoring tor my ISP allows tor without bridges as a client but my ssh service that I run over tor for ddns was blocked until I used bridges so even in the US they do DPI to block hosting services over tor but they allow client access to anything over tor so bridges in iat mode 2 prevents them from knowing the difference between client and server tor connections and everything works
Yes it is tor uses distributed centralized matching servers and if you proxy dns through tor it normally goes to cloudflare you can send clearnet dns to cloudflares onion service but that still requires trusting distributed centralized matching servers that can be poisoned by the NSA using there quantum computer to steal private keys then redirecting all traffic to a fake version of the site that sends malware to all users that's why I put ssh behind wireguard psk behind udp tunnel behind tor for ddns so they won't be able to poison my service because they won't know the psk and all pre quantum encryption should be considered broken because the NSA has a quantum computer and my ISP does DPI to block only hosting onion services so everything I said is true
The Russian Tor censorship sounds a lot like Soviet radio jamming. I wonder if most of the censorship office are women? It was mostly women working on jamming Western radio.
Having any restrictions on bridges is a huge problem if you don't allow users to add there exclude nodes list because I already have to retry getting bridges for a couple hours using tor to randomize my IP to get a few bridges that aren't in fascist countries like the US and EU that censor the internet so they are more likely to block hosting onion services like my ISP does it is not as bad as Chinese or Russian bridges but they are unacceptable for anyone that cares about privacy and security not just anonymity for client side access
It doesn't matter whether your bridge is in a fascist country (like the one you are in). Your bridge doesn't know what sites you are accessing. I know you live in a fascist country because you wouldn't need a bridge otherwise.
Yes it does matter because they can block only hosting onion services by doing DPI on the output from the bridge and it is terrible security to use a bridge in the US, EU, 14 eyes, or any other country that does any internet censorship because your bridge and exit node are more likely to cooperate and de-anonymize you and your bridge is more likely to be compromised by the NSA so I exclude all of them and my tor service refuses to connect to any bridge hosted in those countries so you are wrong also bridges are necessary for anyone that cares about privacy not just people that can't connect to tor because bridges obfuscate tor use just like tor over vpn but it is harder for the US government to get search warrants for them because at least in US law node operators aren't responsible for any tor traffic so they have no reason to help the government unless they are a fascist because the government can't threaten to arrest them because there are already laws protecting them from that because it was invented by the US government and they wanted other people to help hide their traffic
@@josiahsharkey7520 The output from a bridge is still encrypted 3 times. You might be confusing bridges and exit relays. The output from an exit relay is still encrypted 1 time unless you don't use HTTPS which you should always use with Tor.
@@thewhitefalcon8539 that's not true it isn't encrypted well enough to hide the difference between client and server even on the first hop my ISP blocks only onion services so DPI can tell the difference even with 5 layers of encryption on the data using ssh, wireguard, and tor and do you really think the NSA can't get a certificate trusted by a root CA in your browser to man in the middle the output of the exit node so https isn't real security against nation state attackers and if the bridge and exit node cooperate you lose all anonymity unless you use post quantum security and there are enough people like me that run post quantum security over tor on the same circuit and using https on an onion service loses all anonymity unless you require adding a hybrid post quantum root CA to every users computer and run your own CA I don't need this level of security, privacy, and anonymity because I am only using it for remote access to my computers I don't have active nation state attackers but other people do and if I use this level of security it helps protects them from being traced because they can't rule me out as their target as easily
The number of people who use Tor for the purposes claimed is tiny. It's just hammering the banking system and killing ecommerce... and a few other more serious things.
This was a great talk, that's my bald head at the bottom left of the podium.
haha
Hey sam, do you trust the privacy system of tor snowflake browser addons for americans?
Roger is an absolute hero. Love hearing him talk.
I love how he talked at the start about Syria blocking TLS, a Syrian previous media activist, used TOR all through 2011 and 2012, got arrested by the Syrian regime intelligence and all what they accused me of is "having suspicious internet activities" but then I got released, I do remember emailing the TOR project for a specific question (I wanted a port forwarding recommendation for live streams using my android phone to stream a protest) and they were very very helpful and literally kept talking to me not just about this question, but also giving my tips specifically for my case use of TOR, can't that you enough guys! and please consider to run a node if u can it helps ppl (and don't use bridges if u don't need to please!)
41:22 - "I think Russia has already blocked Facebook, but next it's gonna be, like, Linkedin" - nope, it's blocked already, in fact. Had been even earlier than Facebook, if I recall correctly
nooooooooooooooooooooooooooooooooooooooooooo
Legendary and thankless work!
Do you remember that Futurama episode where Hermes contested document based on wrong number of stamps? Basically that's what happened in Russia.
I never heard of snowflake, installed the extension right away!
I had heard about it but I installed it now too.
i tried to start reading through the tor docs, boy is it thorough, I dont know if I'll ever be able to fully grasp it
This talk aged like milk. Nowadays WebRTC, fronted domains and *the entire Hetzner network* are blocked in Russia
Awesome vid! Thanks for the talk guys!
Hmm, would it be possible to replace the Bitcoin proof of work with some kind of proof of transport so that mining becomes the provision of Tor relays?
You might want to have a look at the Helium network - but on the Internet instead of wireless. One problem, though: just because some node transported your proof of transport doesn't mean it will also transport your actual traffic.
@@thewhitefalcon8539 Right, but if you encrypt the traffic and the proof so that the node doing the transport can't tell the difference. Designing it right to have all the right incentives would be hard but u could probably get at least a probabilistic guarantee they'd transport traffic.
@@petergerdes1094 Good idea.
@@petergerdes1094 You know, if you have the time you could actually make this.
@@petergerdes1094 hmm i like where this is going, in a sense.. but.. hm..
Amazing talk
What is the SALMON / LOX stuff he mentioned about decentralized trust / reputation? I can't find anything about it online.
www.google.com/search?q=salmon+lox+decentralized+trust+-fish+-recipe
Google “Lox: Protecting the Social Graph in Bridge Distribution” (there’s a whitepaper on petsymposium)
For salmon you can start with wikipedia article for “Salmon (protocol)”
Thank for your work while we waited for i2p
One of the reason of huge spike in Tor connections from Ukraine during first weeks of the russian invasion, that many hacktivists uses Tor for DDoS of the russian propaganda sites, financial and logistic infrastructure. But usage of Tor turned out to be ineffective, so different measures were taken later.
Using Tor for DDoS is such a big brain move.
@@JGnLAU8OAWF6 I know. But some russian banks was unhappy even on this traffic.
Maybe TOR use spiked in Ukraine during the Russian invasion because Russian military uses TOR in some of their application/devices?
30:25 uncertainty is certain
We might be about to get occupied, max uncertainty in the people with something to lose ? some subset of people in the moment need to do something. Move some Bitcoin out of the country ? send a message about relocation ? not willing to hang around. Clear to everyone shit is not going to be good. Whatever it was, significant change of some sort was the only priority for this subset of people and their circumstances. Relatively small group, other countries would have drastically different stats.. some would see sustained and perhaps S curve adoption, civil war possibilities etc etc
Fascinating, amazing presentation
U called?
...And that sometimes hard to take,
But it will become much clearer
With every new choice you make.
mTLS should be considered for the bridges, then maybe you can give out keys instead of just addresses, if a good key isn't provided, just ignore it and give a different webpage.
If the bridges are typically volunteers and not real websites, a state actor would just block the IP and not care what the key is, right?
Spikes in tor users in Ukraine on the intitial days may be :
- Russians living in Ukraine wanting to get out of Ukraine
- Ukraine civilains wanting to get out of Ukraine
- Ukraine civilians wanting to defect from Ukraine
Either or all, non of them wanting their intention exposed
Does snowflake works for ipv6 only? Ipv4 cg-nat
If WebRTC works on your connection then Snowflake works. ISPs want WebRTC to work, because that's like, Discord voice chat.
Great talk, thank you.
Here in Merica, people are proud of the 2nd. The right to bear arms. The fight of a few rednecks in pickups vs US military, anyone can see that outcome. What is MOST important is the ability to communicate freely and evade censorship is VITAL. Especially in totalitarian nations where the people have no way to fight back other than numbers. If the Chinese people could ever get on the same page, they could topple the government just from mass numbers. A government can't kill or imprison 75% of the population.
"few rednecks in pickups vs US military, anyone can see that outcome". Yeah I think usa and Russia thought the same about Afghanistan...went great for the two largest superpowers vs a bunch of "goat herders".
@@bryant2627they had mountains to hide in. It’s a totally different gorilla war fare in them mountains. The afghans also were born into defense due to the Russians trying to invade and the cia gave them old Cold War stockpile anti air missle sand old aks delta force or green beret probably taught them basic combat concepts and outcomes. That or cia. The afghans are the best at walking threw them mountains. Special forces said they are like goats there so strong from walking mountains all there life they say in the hub where they work up mission plan that if a afghan gets his legs around you your dead you won’t be able to get him off.
Russian hackers are the ones that are using the most sofisticated and more reliable access to TOR. Even the ones working for the government. All the accesses should be easy, since the average people (the one that give or need information) is surely not able to go further than downloading and launching the TOR browser (and already this is not so average). If not those "bad" ones are the only people that will benefit...
Russia has plenty of out of country proxy’s to access tor from. The damage caused be helping the Russian people see all the facts of the war is worth the effort
@@tobysonline4356 You forgot to put "facts" in quotes.
No. Tor not used only by "bad ones". FSB and other f*ckfaces are most likely have their own VPS in Europe, legally bought by the way; yes, you still can buy VPS with Russia's bank account, and maybe Im already gone insane, but I think "normal" russians can get problems with police if they look into your account and find that you bying proxy for yourselves, and god forbid you use it to do something that "descriminates army of Russia".
Tor is just too slow in general and often connections are just dying, but it's nice to have, especially when you don't want to install random "VPN" crap on your computer and have accounts for it.
@@tobysonline4356 poor us Russians w/o access to BBC LMAO westoids are so delusional
This dude has the exact cadence of Jeff Goldblum 👌
arma ftw, great presentation
30:24 mind that Ukraine also has been doing censorship of major websites from 2016 or so
in an unstable situation reaching for sources of information from both sides might have been important for many
Why would I want to hear from both sides of that conflict?
@@johngiaus8632 ...because not doing that is the exact definition of information bubble and you need to educate yourself on that?
@@johngiaus8632 The Ukrainian government could lie or censor news to paint themselves in a more positive light or preserve military secrecy, while Russian media reported on which city your friends live in just got hit with a missile strike. You need to be able to piece together the truth for yourself from multiple sources
several reasons ukrainians or other people in ukraine could want safe comms with people in russia. the biggest group are family connections, second group is businesses and organizations operating in both countries. pro-russia operators in ua are probably not numerous enough to contribute much to such stats.
Sad we don't get to hear Jacob Applebaum talk on Tor a
Raising hands upon questioned who runs relays.... Ehmmm.... 🤣🤣🤣
Relays are public information.
@@thewhitefalcon8539 even IP public addresses are but you still try to hide it :)
@@ivanslaboratory The IP addresses of all Tor relays and the real-life owners of most are public info. That's how you know you're not getting an evil relay
@@thewhitefalcon8539The identity being published does not mean is legitimate, could be name borrowers. Same as your public IP address could be someone's elses. :)
To my knowledge exit nodes are public info, so that can be blocked in case :)
40:00 sanctions for communication services should be refusing to accept censorship mandates from that country
32:06 nostr pubkeys? 🤔
i would say that rt and similar outlets are at least equal to social engineering. If all people would be informed about the background, mo and goals of these disinformation campaigns, they would treat them as such. But this level of knowledge is just not there, they are currently incredibly harmful and no democracy has tools or strategies at place to fight them. Banning is a brute force approach yes, but it is necessary to act on this someway.
Absolutely right.
Ok, and _Who_ defines the disinformation exactly?
@@fus132the integrity initiative.
Commenting for the algorithm
AEweb thoughts ? building on this web3 platform with Uniris biometrics and hierarchical transaction chains structure seems.. unbounded ? "the first ever tamperproof identification that doesn't store any data" is the main selling point but integrating the various technologies of today in the way they have is potentially the end game for defenders ?
Imagine all content on the internet has a meta tag of human or not..
I want those docs, I don't tor or telegram, give me safe access and let us process our way 😊 #aibot
"Please consider this as the DEF CON audience that you are" lol
Tor still has centralization it uses centralized dns servers for all dns you can proxy dns over tor but it still requires trust of centralized dns servers onion services also use centralized matching servers they do allow you to encrypt the metadata on the central server but it is encryption that the NSA can break with there quantum computer and it requires setting up a key pair for each user also Russia isn't the only one censoring tor my ISP allows tor without bridges as a client but my ssh service that I run over tor for ddns was blocked until I used bridges so even in the US they do DPI to block hosting services over tor but they allow client access to anything over tor so bridges in iat mode 2 prevents them from knowing the difference between client and server tor connections and everything works
not correct
Yes it is tor uses distributed centralized matching servers and if you proxy dns through tor it normally goes to cloudflare you can send clearnet dns to cloudflares onion service but that still requires trusting distributed centralized matching servers that can be poisoned by the NSA using there quantum computer to steal private keys then redirecting all traffic to a fake version of the site that sends malware to all users that's why I put ssh behind wireguard psk behind udp tunnel behind tor for ddns so they won't be able to poison my service because they won't know the psk and all pre quantum encryption should be considered broken because the NSA has a quantum computer and my ISP does DPI to block only hosting onion services so everything I said is true
How Many People Have Heard Of Mice ?
The Russian Tor censorship sounds a lot like Soviet radio jamming. I wonder if most of the censorship office are women? It was mostly women working on jamming Western radio.
Having any restrictions on bridges is a huge problem if you don't allow users to add there exclude nodes list because I already have to retry getting bridges for a couple hours using tor to randomize my IP to get a few bridges that aren't in fascist countries like the US and EU that censor the internet so they are more likely to block hosting onion services like my ISP does it is not as bad as Chinese or Russian bridges but they are unacceptable for anyone that cares about privacy and security not just anonymity for client side access
It doesn't matter whether your bridge is in a fascist country (like the one you are in). Your bridge doesn't know what sites you are accessing. I know you live in a fascist country because you wouldn't need a bridge otherwise.
Yes it does matter because they can block only hosting onion services by doing DPI on the output from the bridge and it is terrible security to use a bridge in the US, EU, 14 eyes, or any other country that does any internet censorship because your bridge and exit node are more likely to cooperate and de-anonymize you and your bridge is more likely to be compromised by the NSA so I exclude all of them and my tor service refuses to connect to any bridge hosted in those countries so you are wrong also bridges are necessary for anyone that cares about privacy not just people that can't connect to tor because bridges obfuscate tor use just like tor over vpn but it is harder for the US government to get search warrants for them because at least in US law node operators aren't responsible for any tor traffic so they have no reason to help the government unless they are a fascist because the government can't threaten to arrest them because there are already laws protecting them from that because it was invented by the US government and they wanted other people to help hide their traffic
@@josiahsharkey7520 The output from a bridge is still encrypted 3 times. You might be confusing bridges and exit relays. The output from an exit relay is still encrypted 1 time unless you don't use HTTPS which you should always use with Tor.
@@thewhitefalcon8539 that's not true it isn't encrypted well enough to hide the difference between client and server even on the first hop my ISP blocks only onion services so DPI can tell the difference even with 5 layers of encryption on the data using ssh, wireguard, and tor and do you really think the NSA can't get a certificate trusted by a root CA in your browser to man in the middle the output of the exit node so https isn't real security against nation state attackers and if the bridge and exit node cooperate you lose all anonymity unless you use post quantum security and there are enough people like me that run post quantum security over tor on the same circuit and using https on an onion service loses all anonymity unless you require adding a hybrid post quantum root CA to every users computer and run your own CA I don't need this level of security, privacy, and anonymity because I am only using it for remote access to my computers I don't have active nation state attackers but other people do and if I use this level of security it helps protects them from being traced because they can't rule me out as their target as easily
Cohorting and timing just like google, lol thanks but no for me.
bridgecoin
"Translate to english" 😂
The number of people who use Tor for the purposes claimed is tiny. It's just hammering the banking system and killing ecommerce... and a few other more serious things.
ишь какой ушлый молодой чемодан. надеюсь российские математики шо-нить придумают в ответ
Лично я надеюсь что роскомпараша наконец додумается перестать сливать мои налоги в унитаз и расформируется
Nice distribution for taking over all the nodes and vote for Hilary .
How is the FBI trying to infiltrate Tor? Will we get that talk?